How to setup the network of a validator node?

Question

I read good practices of how to setup a validator node, but I did not see a network part.

A validator node should not expose a public RPC API (it should only be internal, allowing access through a VPN or ssh tunnel), but what should it do for its p2p endpoint? Because it can explore the network thanks to the bootnodes, does it really have to listen to incoming p2p connections or can it rely only on the bidirectional connections it initiates to other parts of the network?

If it exposes a public address, should it listen directly on TCP or can it wrap incoming connections in a websocket or so?

Answer 1

Generally speaking you should allow inbound connections as well, it contributes positively to the overall connectivity of the network. Lately there has been some issues opened on the Substrate repository about syncing slowing down and this was attributed partly to there simply being too many full nodes on the network. You can imagine that blocking inbound connections doesn't help this situation as your node will occupy slots on other publicly reachable nodes but doesn't itself offer any slots for other full nodes.

We're doing some research in providing ability to do hole punching over QUIC but that is likely months away but it would take firewall configuration out of the equation and make it easier to allow inbound connections.

Answer 2

It's totally up to you.

Even if you close that port, you can still connect to others and produce blocks.

You can refuse any incoming connection. It's just others can't connect to your node.